Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Search SSL_CERT_FILE before SSL_CERT_DIR #37

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Search SSL_CERT_FILE before SSL_CERT_DIR #37

wants to merge 2 commits into from

Conversation

visr
Copy link

@visr visr commented Dec 14, 2024 •
edited
Loading

This aligns better with the behavior of openssl.
This should fix the issue of Windows users starting julia from a conda environment running into Pkg issues.
Fixes JuliaLang/Downloads.jl#244
See JuliaLang/Downloads.jl#244 (comment).

@visr
Search SSL_CERT_FILE before SSL_CERT_DIR
9c0a877 
This aligns better with the behavior of openssl.
See JuliaLang/Downloads.jl#244 (comment)
@visr
Copy link
Author

visr commented Dec 20, 2024

This shows it in action:

pixi run a:/repo/julia/usr/bin/julia.exe

# these were set by the openssl conda activation scripts
julia> ENV["SSL_CERT_FILE"]
"D:\\temp\\asd\\.pixi\\envs\\default\\Library\\ssl\\cacert.pem"

julia> ENV["SSL_CERT_DIR"]
"D:\\temp\\asd\\.pixi\\envs\\default\\Library\\ssl\\certs"

julia> using NetworkOptions: CA_ROOTS_VARS, ca_roots

# order has changed
julia> CA_ROOTS_VARS
3-element Vector{String}:
 "JULIA_SSL_CA_ROOTS_PATH"
 "SSL_CERT_FILE"
 "SSL_CERT_DIR"

# this now returns the SSL_CERT_FILE instead of the SSL_CERT_DIR, as intended
julia> ca_roots()
"D:\\temp\\asd\\.pixi\\envs\\default\\Library\\ssl\\cacert.pem"

# this no longer logs errors, indicating this indeed fixes https://github.com/JuliaLang/Downloads.jl/issues/244
(@v1.12) pkg> registry up
    Updating registry at `a:\.julia\registries\General.toml`

(@v1.12) pkg> dev Example
     Cloning git-repo `https://github.com/JuliaLang/Example.jl.git`
ERROR: failed to clone from https://github.com/JuliaLang/Example.jl.git, error: GitError(Code:ERROR, Class:SSL, Your Julia is built with a SSL/TLS engine that libgit2 doesn't know how to configure to use a file or directory of certificate authority roots, but your environment specifies one via the SSL_CERT_DIR variable. If you believe your system's root certificates are safe to use, you can `export JULIA_SSL_CA_ROOTS_PATH=""` in your environment to use those instead.)

Unfortunately the latter still fails, now blaming SSL_CERT_DIR since it is last, even though it now tried to set SSL_CERT_FILE. The error comes from here. I guess "TLS backend doesn't support certificate locations" means either a cert_file or cert_dir. Reading the error I assumed this just wasn't supported for MbedTLS, but the code seems to me like a build flag need to be set: https://github.com/libgit2/libgit2/blob/4dcdb64c6844d76776745cdc25071a72c1af84d6/src/libgit2/settings.c#L206-L222. Would it make sense to enable that with JuliaLang/julia#56708?

In any case, this last point should perhaps be a LibGit2.jl issue, IMO this is good to go.

visr added a commit to visr/julia that referenced this pull request Dec 31, 2024
@visr
Don't error when initializing LibGit2 with CA roots path
ce84aac 
When e.g. SSL_CERT_FILE is set, we cannot set this location in LibGit2_jll because it isn't built with support for that. Until now we've errored out with a message telling users to set JULIA_SSL_CA_ROOTS_PATH to an empty string.

This changes the behavior to allow this expected error. Variables like SSL_CERT_FILE are for instance set by Conda, ensuring many people running into this, see e.g. https://discourse.julialang.org/search?q=JULIA_SSL_CA_ROOTS_PATH.

The other part, and some more context for this, is here: JuliaLang/NetworkOptions.jl#37 (comment)
@visr visr mentioned this pull request Dec 31, 2024
Open
@visr
More explicitly test precedence
65eacbd 
In a way that would fail with the old precedence.
@codecov Codecov
Copy link

codecov bot commented Jan 2, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 94.81%. Comparing base (8eec5cb) to head (65eacbd).

Additional details and impacted files 
@@            Coverage Diff             @@
##           master      #37      +/-   ##
==========================================
- Coverage   95.55%   94.81%   -0.75%     
==========================================
  Files           4        4              
  Lines         135      135              
==========================================
- Hits          129      128       -1     
- Misses          6        7       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

visr added a commit to visr/julia that referenced this pull request Jan 2, 2025
@visr
Don't error when initializing LibGit2 with CA roots path
4f2f105 
When e.g. SSL_CERT_FILE is set, we cannot set this location in LibGit2_jll because it isn't built with support for that. Until now we've errored out with a message telling users to set JULIA_SSL_CA_ROOTS_PATH to an empty string.

This changes the behavior to allow this expected error. Variables like SSL_CERT_FILE are for instance set by Conda, ensuring many people running into this, see e.g. https://discourse.julialang.org/search?q=JULIA_SSL_CA_ROOTS_PATH.

The other part, and some more context for this, is here: JuliaLang/NetworkOptions.jl#37 (comment)
visr added a commit to visr/julia that referenced this pull request Jan 7, 2025
@visr
Don't error when initializing LibGit2 with CA roots path
e33618a 
When e.g. SSL_CERT_FILE is set, we cannot set this location in LibGit2_jll because it isn't built with support for that. Until now we've errored out with a message telling users to set JULIA_SSL_CA_ROOTS_PATH to an empty string.

This changes the behavior to allow this expected error. Variables like SSL_CERT_FILE are for instance set by Conda, ensuring many people running into this, see e.g. https://discourse.julialang.org/search?q=JULIA_SSL_CA_ROOTS_PATH.

The other part, and some more context for this, is here: JuliaLang/NetworkOptions.jl#37 (comment)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@StefanKarpinski StefanKarpinski Awaiting requested review from StefanKarpinski

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

curl_easy_setopt: 4 when using Pkg
1 participant
@visr